CVE-2023-35152: XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
Impact Any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.
Patches The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.
Workarounds The vulnerability can be fixed by applying this patch.
On versions before 13.4-rc-1, the fix needs to be applied on XWiki.Like.Code.LiveTableResultPage.
References - The reported issue https://jira.xwiki.org/browse/XWIKI-20611, fixed by https://jira.xwiki.org/browse/XWIKI-19900 - The patch https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49 For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-like-uito a version that resolves this vulnerability.Fixed in 15.1 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-like-uito a version that resolves this vulnerability.Fixed in 14.10.6 - Upgrade
Upgrade
maven/org.xwiki.platform:xwiki-platform-like-uito a version that resolves this vulnerability.Fixed in 14.4.8 - Upgrade
Upgrade
xwiki-platformto a version that resolves this vulnerability.Fixed in 14.4.8 - Upgrade
Upgrade
xwiki-platformto a version that resolves this vulnerability.Fixed in 14.10.6 - Upgrade
Upgrade
xwiki-platformto a version that resolves this vulnerability.Fixed in 15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch XWIKI-19900 - Configuration
For XWiki Platform versions before 13.4-rc-1, apply the fix on XWiki.Like.Code.LiveTableResultPage as referenced in the advisory (patch at commit 0993a7ab3c102f9ac37ffe361a83a3dc302c0e45).
XWiki.Like.Code.LiveTableResultPage patch application = apply fix before 13.4-rc-1 (and per statement: on versions before 13.4-rc-1, apply this patch on XWiki.Like.Code.LiveTableResultPage) - Operational
If you applied the workaround patch manually (instead of upgrading), ensure it is applied to the affected code path referenced by the advisory for the relevant XWiki versions.
Event History
Frequently Asked Questions
What is CVE-2023-35152?
CVE-2023-35152 is a vulnerability in XWiki Platform that allows any logged in user to add dangerous content in their first name field and execute it with programming rights, leading to rights escalation.
How severe is CVE-2023-35152?
CVE-2023-35152 has a severity score of 8.8 (critical).
Which versions of XWiki Platform are affected by CVE-2023-35152?
Versions 12.9-rc-1 to 14.4.8, 14.10.6, 15.0, and 15.0-rc1 of XWiki Platform are affected by CVE-2023-35152.
How can I fix CVE-2023-35152?
To fix CVE-2023-35152, you should upgrade to XWiki Platform versions 14.4.8, 14.10.6, 15.0, or 15.0-rc1.
Are there any references for CVE-2023-35152?
Yes, you can find more information about CVE-2023-35152 at the following references: [Link 1](https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39), [Link 2](https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49), [Link 3](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm).